Skip to content
OpenAdvisories
Medium WID-SEC-2025-2267 7 CVEs

Liferay Portal: Mehrere Schwachstellen

Published Oct 13, 2025 · Updated Oct 13, 2025 · de-DE

Vendor: Liferay Product: DXP Product: Portal Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Liferay Portal und Liferay DXP ausnutzen, um Informationen offenzulegen Daten zu manipulieren und Cross Site Skripte auszuführen.

Product

Liferay Portal ist eine Open-Source-Webplattform für Unternehmen, die ein Framework für die Erstellung und Verwaltung von webbasierten Anwendungen und Inhalten bietet.
Liferay DXP (Digital Experience Platform) ist eine erweiterte und kommerziell unterstützte Version von Liferay Portal, die zusätzliche Funktionen und Dienste bietet.

Vulnerabilities 7

  • Medium 5.3
    CVE-2025-62241

    Liferay Commerce Order Content Web is Vulnerable to Authorization Bypass Through User-Controlled Key

    Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to from one virtual instance to view the shipment addresses of different virtual instance via the _com_l…

    Liferay DXP com.liferay.commerce:com.liferay.commerce.order.content.web Maven
  • Medium 5.3
    CVE-2025-62242

    Liferay Account Admin Web vulnerable to Authorization Bypass Through User-Controlled Key

    Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated users …

    Liferay DXP Portal com.liferay:com.liferay.change.tracking.web Maven
  • Medium 5.3
    CVE-2025-62243

    Liferay Publications is vulnerable to Incorrect Authorization

    Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92 allows remote authenticated attackers to vi…

    Liferay DXP Portal com.liferay:com.liferay.change.tracking.web Maven
  • Medium 5.3
    CVE-2025-62252

    Liferay is Vulnerable to Authorization Bypass Through User-Controlled Key

    Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported version…

    Liferay DXP Portal com.liferay.portal:com.liferay.portal.impl Maven
  • Medium 4.8
    CVE-2025-62244

    Liferay Publications vulnerable to Authorization Bypass Through User-Controlled Key

    Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 GA through update 92, and 7.3 GA through update 36 allows remote…

    Liferay DXP Portal com.liferay:com.liferay.change.tracking.web Maven
  • Medium 4.8
    CVE-2025-62246

    Liferay Mentions Web is Vulnerable to Cross-site Scripting

    Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported ver…

    Liferay DXP Portal com.liferay:com.liferay.mentions.web Maven
  • Medium 4.8
    CVE-2025-62251

    Liferay has Incorrect Permission Assignment for Critical Resource

    Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 and 7.3 GA though update 36 shows content to users who do not have permission to view it via the Menu Display Widget. Th…

    Liferay DXP Portal com.liferay:com.liferay.site.navigation.menu.item.asset.vocabulary Maven

Revision history

  1. #1

    Initiale Fassung

References